AI Sec Weekly is a briefing on AI security: the incidents, vulnerabilities, tooling changes and regulatory moves worth knowing about, each one linked back to its source. The site publishes standing reference pages, revised whenever the underlying research, CVE record or tooling changes, plus occasional midweek briefings when a single item is too time-sensitive to sit and wait for context.
This page is the standing account of how that coverage is chosen and written. The same selection bar governs every reference page and every briefing.
What earns a place
Candidates are held against four questions, and an item needs a yes on all four.
Is this AI-specific? In scope: models and their weights, agents with tool access, retrieval pipelines, tool and connector integrations, the training and fine-tuning data supply chain, inference infrastructure, and the regulation aimed at all of it. Out of scope: a breach at an AI company caused by an unpatched edge appliance. The test is whether the AI component is causal or merely nearby. Plenty of significant security news fails this test, and that is fine, because it is somebody else’s beat.
Is there a primary source? Something citable sits under every entry: a vendor advisory, a CVE record, a paper, a repository commit, a regulator’s own publication, a court filing. Summaries of summaries are the dominant failure mode in this beat, and each hop away from the source loses precision that never comes back.
Does it change a decision? Readers are assumed to own something: a deployed assistant, a fine-tuning pipeline, an agent wired into internal tools, or a compliance obligation with a date on it. If the honest answer to “so what do I do differently” is nothing, the item drops to a reading list at best.
Will it still be true next month? Preference goes to durable classes over one-week novelty. A specific jailbreak string patched out on a Tuesday is trivia. The technique class it belongs to is not, which is why prompt injection keeps earning space while individual payloads rarely do.
How items are written
House style, applied to every entry:
Consequence first. The opening line says what the reader has to care about. Who announced it, and when, comes after the impact rather than in front of it.
Name the thing precisely. Affected product, affected versions, affected configuration. “Some LLM gateways” is not a finding. Where the exact scope is not yet public, the entry states that instead of implying more precision than exists.
Confirmed and claimed stay separated. Vendor-acknowledged facts, independently reproduced results, and unverified assertions all appear, but they are labelled differently inside the same entry so a reader can tell which weight to give each.
No invented numbers. Where a paper or advisory reports a figure it is quoted with the source attached. Where no credible figure exists, none is supplied. A percentage with no provenance behind it is worse than leaving the gap visible. Nothing here is a measurement taken by this site; every number traces to a named external source.
One action per item. Patch, restrict, monitor, re-scope, or explicitly wait. An entry that stops before naming the next step is not finished.
Kept short. Entries are sized to be read, not to demonstrate effort. The depth lives in the linked source, which is why the link is there.
The site publishes under an editorial byline rather than an individual one. Judge any entry by the source sitting under it.
What stays out
- Items still at rumour stage, unless a second independent source appears.
- Benchmark claims with no reproducible method published alongside them.
- Stories where AI is decoration: a phishing email drafted with a chatbot, a database left open at a company that happens to sell an AI product.
- Aggregator posts restating other people’s reporting. The original gets the link.
- Severity ratings that cannot be substantiated. Where an official score exists it is cited; where none exists, none gets manufactured for narrative convenience.
- Anything sourced solely to an anonymous post with no corroboration anywhere else.
Corrections
Corrections are made in place, with the change left visible rather than edited out overnight. A site that ranks and rates stories is making explicit calls, and some of them will be wrong; the useful response is a visible correction, not a quiet revision. If something here is wrong, out of date, or attributed to the wrong source, the about page has the address to send it to.
Who this is for
The reader in mind is someone who will have to act on it. Application security engineers reviewing an LLM feature before it ships. Platform teams responsible for pipelines, weights, and the provenance of both. Red teamers deciding where to point the next engagement. Governance and compliance readers tracking which obligation acquires a deadline next. Anyone looking for market commentary or funding-round coverage will be better served elsewhere.
Start here
Prompt injection attack examples is the most-read reference on the site; agent security risks and jailbreak defence techniques are the next two. When a single item cannot wait, it goes out as its own briefing, as the LiteLLM gateway CVE and the AI-on-offence roundup did. To pull older weekly coverage into one brief filtered to the topics you track, use the catch-up builder. For an unfiltered daily stream of the same beat, AI Sec Digest covers it.
